CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
What the vulnerability does
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.3.7, vulnerable parameter &yith_maintenance_newsletter_submit_label. Possible even when unfiltered HTML is disallowed by WordPress configuration.
Explanation of Vulnerability in Simple Terms
The YITH Maintenance Mode plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.3.7. An authenticated administrator with high privileges can inject malicious JavaScript that executes in the browsers of other users who view the maintenance mode page. The vulnerability requires user interaction and affects the scope beyond the plugin itself.
What an attacker can do
Inject malicious JavaScript that runs in other users' browsers when they view the maintenance mode page.
Potential impact on your site
A malicious admin can steal session tokens, redirect users, or deface the maintenance mode message seen by site visitors.
Conditions required to exploit
Attacker must have administrator-level access to WordPress and the victim must visit the affected page.
Key dates
External resources
Related vulnerabilities
